From cfcf561c69dd2c7e37cbadd355cc10616a3d8b4d Mon Sep 17 00:00:00 2001 From: Replit Agent Date: Fri, 31 Jul 2026 20:26:33 +0000 Subject: [PATCH 1/7] Add replit configuration file Replit-Commit-Author: Agent --- .replit | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .replit diff --git a/.replit b/.replit new file mode 100644 index 0000000000..416c2b6be0 --- /dev/null +++ b/.replit @@ -0,0 +1,7 @@ +modules = ["python-3.12", "bash", "web", "nodejs-20", "rust-stable"] + +[nix] +channel = "stable-25_05" + +[agent] +expertMode = true From 30f033f54e9d1919da15ed8585e976f16047c719 Mon Sep 17 00:00:00 2001 From: Replit Agent Date: Fri, 31 Jul 2026 21:09:02 +0000 Subject: [PATCH 2/7] Initialize find-skills agent capabilities and project documentation Replit-Commit-Author: Agent --- .agents/skills/find-skills/SKILL.md | 141 +++++++++++++++++++++++ replit.md | 167 ++++++++++++++++++++++++++++ skills-lock.json | 11 ++ 3 files changed, 319 insertions(+) create mode 100644 .agents/skills/find-skills/SKILL.md create mode 100644 replit.md create mode 100644 skills-lock.json diff --git a/.agents/skills/find-skills/SKILL.md b/.agents/skills/find-skills/SKILL.md new file mode 100644 index 0000000000..a41bdd074b --- /dev/null +++ b/.agents/skills/find-skills/SKILL.md @@ -0,0 +1,141 @@ +--- +name: find-skills +description: Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill. +--- + +# Find Skills + +This skill helps you discover and install skills from the open agent skills ecosystem. + +## When to Use This Skill + +Use this skill when the user: + +- Asks "how do I do X" where X might be a common task with an existing skill +- Says "find a skill for X" or "is there a skill for X" +- Asks "can you do X" where X is a specialized capability +- Expresses interest in extending agent capabilities +- Wants to search for tools, templates, or workflows +- Mentions they wish they had help with a specific domain (design, testing, deployment, etc.) + +## What is the Skills CLI? + +The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools. + +**Key commands:** + +- `npx skills find [query] [--owner ]` - Search for skills interactively or by keyword, optionally scoped to a GitHub owner +- `npx skills add ` - Install a skill from GitHub or other sources +- `npx skills update` - Update all installed skills + +**Browse skills at:** https://skills.sh/ + +## How to Help Users Find Skills + +### Step 1: Understand What They Need + +When a user asks for help with something, identify: + +1. The domain (e.g., React, testing, design, deployment) +2. The specific task (e.g., writing tests, creating animations, reviewing PRs) +3. Whether this is a common enough task that a skill likely exists + +### Step 2: Check the Leaderboard First + +Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) to see if a well-known skill already exists for the domain. The leaderboard ranks skills by total installs, surfacing the most popular and battle-tested options. + +For example, top skills for web development include: +- `vercel-labs/agent-skills` — React, Next.js, web design (100K+ installs each) +- `anthropics/skills` — Frontend design, document processing (100K+ installs) + +### Step 3: Search for Skills + +If the leaderboard doesn't cover the user's need, run the find command: + +```bash +npx skills find [query] [--owner ] +``` + +For example: + +- User asks "how do I make my React app faster?" → `npx skills find react performance` +- User asks "can you help me with PR reviews?" → `npx skills find pr review` +- User asks "I need to create a changelog" → `npx skills find changelog` + +### Step 4: Verify Quality Before Recommending + +**Do not recommend a skill based solely on search results.** Always verify: + +1. **Install count** — Prefer skills with 1K+ installs. Be cautious with anything under 100. +2. **Source reputation** — Official sources (`vercel-labs`, `anthropics`, `microsoft`) are more trustworthy than unknown authors. +3. **GitHub stars** — Check the source repository. A skill from a repo with <100 stars should be treated with skepticism. + +### Step 5: Present Options to the User + +When you find relevant skills, present them to the user with: + +1. The skill name and what it does +2. The install count and source +3. The install command they can run +4. A link to learn more at skills.sh + +Example response: + +``` +I found a skill that might help! The "react-best-practices" skill provides +React and Next.js performance optimization guidelines from Vercel Engineering. +(185K installs) + +To install it: +npx skills add vercel-labs/agent-skills@react-best-practices + +Learn more: https://skills.sh/vercel-labs/agent-skills/react-best-practices +``` + +### Step 6: Offer to Install + +If the user wants to proceed, you can install the skill for them: + +```bash +npx skills add -g -y +``` + +The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. + +## Common Skill Categories + +When searching, consider these common categories: + +| Category | Example Queries | +| --------------- | ---------------------------------------- | +| Web Development | react, nextjs, typescript, css, tailwind | +| Testing | testing, jest, playwright, e2e | +| DevOps | deploy, docker, kubernetes, ci-cd | +| Documentation | docs, readme, changelog, api-docs | +| Code Quality | review, lint, refactor, best-practices | +| Design | ui, ux, design-system, accessibility | +| Productivity | workflow, automation, git | + +## Tips for Effective Searches + +1. **Use specific keywords**: "react testing" is better than just "testing" +2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd" +3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills` + +## When No Skills Are Found + +If no relevant skills exist: + +1. Acknowledge that no existing skill was found +2. Offer to help with the task directly using your general capabilities +3. Suggest the user could create their own skill with `npx skills init` + +Example: + +``` +I searched for skills related to "xyz" but didn't find any matches. +I can still help you with this task directly! Would you like me to proceed? + +If this is something you do often, you could create your own skill: +npx skills init my-xyz-skill +``` diff --git a/replit.md b/replit.md new file mode 100644 index 0000000000..e9acebdc5c --- /dev/null +++ b/replit.md @@ -0,0 +1,167 @@ +# ArchWiz Monorepo — Critical Evaluation & Roadmap + +> Evaluated: 2026-07-31. Stack: Python 3 / Bash / Rust (harmonizer) / TypeScript (commingle-swarm). Origin: Termux/Android monorepo. + +--- + +## What This Is + +A personal **agentic development environment** built around the DeepSeek AI API. The system closes a loop: the user chats with DeepSeek via a terminal CLI (`deepcli`), the ArchWiz cockpit auto-detects and executes code blocks from those conversations, results feed back into the knowledge graph, and a suite of forensic/verification tools (Sentinel, Archivist, Mirror, Dangle Detector) maintain quality and provenance. + +### Pipeline Flow (high-level) +``` +User → DeepSeek (via deepcli) → session cache (~/.deepcli/session_store/) + → archwiz/dispatch_pipeline.py (called on every cache write) + → activity_listener.py (extracts + deduplicates code blocks) + → autonomous_runner.py / dispatch_task.py (sandboxed execution) + → Sentinel (5-gate verification: file integrity, naming, duplicate, probe, shockwave) + → promote.py (ascension to true_versions) + → cli-synthegration (exports, versions, branches conversation history) + → Chronos / time_loop_accelerator (success-only trunk management) + → archwiz/archivist.py (query engine over all indices) +``` + +--- + +## How to Run (on Replit) + +Most tools **cannot run as-is** on Replit — see the Termux coupling issue below. Once that is resolved, the entry point is: + +```bash +python3 archwiz/archwiz.py # Main cockpit (TUI menu) +python3 deepcli/deepcli.py new # Start a new DeepSeek session +python3 deepcli/deepcli.py send "prompt here" +``` + +The DeepSeek integration requires a valid `ds_session_id` cookie and bearer token extracted from a browser session (see `deepcli/extract-token.js`). + +--- + +## Critical Issues (Must Fix) + +### 1. Termux Path Coupling — Blocks Everything +Almost all `subprocess.run(...)` calls in `archwiz/archwiz.py` use `os.path.expanduser('~/archwiz/...')`, which correctly resolves to `/home/runner/archwiz/...` on Replit. However: + +- `archwiz/archwiz.sh` has a hardcoded Termux shebang: `/data/data/com.termux/files/usr/bin/bash` +- `cli-synthegration/workspace/reference/token_provider.py:5` hardcodes `/data/data/com.termux/files/home/deepcli` +- Top-level `enforce_hierarchy.sh` is a broken symlink → `/data/data/com.termux/files/home/workspace/scripts/enforce_workspace_hierarchy.sh` +- Many top-level symlinks (e.g., `dispatch_task.py`, `agent_shell.py`, `archaeologist.py`) point into the Termux filesystem — silently broken on Replit +- Large archive files (`archwiz/pointer_inverted.json`, session logs) contain historical Termux paths — low priority but confusing + +**Fix:** Introduce `ARCHWIZ_HOME` environment variable (default: `~`). Replace all `~/archwiz/...` string construction with `Path(os.environ.get('ARCHWIZ_HOME', Path.home())) / 'archwiz' / ...`. Create a `config.py` in `archwiz/` that provides this resolution. + +### 2. Silent Exception Swallowing in `core.py` +`deepcli/deepcli/core.py:58-59` has a bare `except Exception: pass` around the ArchWiz dispatch call. If the dispatch pipeline fails (missing file, import error, broken path), the failure is completely invisible. The user sees normal operation while the pipeline is dead. + +```python +# current (line ~55-59) +try: + ...dispatch... +except Exception: + pass # ← silent failure, no log, no warning +``` + +**Fix:** At minimum log to stderr: `except Exception as e: print(f"[archwiz dispatch] {e}", file=sys.stderr, flush=True)` + +### 3. Duplicate Completion Paths (`send_message` vs `stream_completion`) +`deepcli/deepcli/core.py` has two chat completion implementations. The methodology log (`archwiz/METHODOLOGY_INDEX.md`) confirms `send_message` had missing `thinking_enabled`/`search_enabled` fields causing "Update to latest version" API errors. The fix was applied but the two paths remain diverged — any future change to one may miss the other. + +**Fix:** Unify behind a single `_build_payload()` function. Both `send_message` and `stream_completion` call it. Remove the old `deepcli_old.py` and the backup `send_message_working` variant. + +### 4. Hardcoded Session ID Default +`archwiz/archwiz.py:349` has a hardcoded session UUID as the fallback: `sid = '417ddd6d-9711-465d-ab90-c92cc04aeabf'`. This is a personal session ID that will silently target a non-existent session for any new user. + +**Fix:** Remove the hardcoded default. If no `.json` files exist in the session store, prompt the user to start a session first. + +### 5. Broken Symlinks at Root +Multiple top-level symlinks are permanently broken on any non-Termux host: +``` +dispatch_task.py → /data/data/com.termux/files/home/workspace/llm_map/dispatch_task.py +agent_shell.py → /data/data/com.termux/.../agent_shell.py +archaeologist.py → /data/data/com.termux/.../archaeologist.py +enforce_hierarchy.sh → /data/data/com.termux/.../enforce_workspace_hierarchy.sh +``` + +**Fix:** Either replace symlinks with relative path symlinks (pointing into `archwiz/` or `cli-synthegration/workspace/`) or remove them and update callers to use the canonical paths. + +### 6. No Dependency Declaration +No `requirements.txt` exists. The Python environment depends on Termux `pkg` installs of: `curl_cffi`, `requests`, `ruff`, `ripgrep`, `fd`, `shellcheck`, `jq`, `entr`. On Replit, these must be installed explicitly. + +**Fix:** Create `requirements.txt` at the root with all Python deps. Add a `setup.sh` that installs system tools via `nix` or the package skill. + +--- + +## Important Warnings + +### `.bak` File Pollution +The `archwiz/` directory contains **~25 timestamped `.bak` files** for `archwiz.py` and `live_view.py` alone (`archwiz.py.bak.1782737822`, `archwiz.py.bak.$(date +%H%M%S)`, etc.). These: +- Inflate repository size +- Make `ls` and `rg` results noisy +- One file is literally named `archwiz.py.bak.$(date +%H%M%S)` — the shell variable was never expanded + +**Recommendation:** Move all `.bak` files to a `_archive/` folder or delete them. Git history is the canonical backup mechanism. + +### commingle-swarm Has No Installed Dependencies +`commingle-swarm/` is a TypeScript/Node project with a `package.json` but no `node_modules/`. It is a self-contained P2P/PWA and appears disconnected from the rest of the monorepo (no import relationships found). It cannot be started without `npm install`. + +--- + +## Optimization Proposals + +### A. Unified Config Layer +Replace all scattered `os.path.expanduser('~/archwiz/...')` calls (~60+ occurrences in `archwiz.py` alone) with a single import: + +```python +# archwiz/config.py +from pathlib import Path +ARCHWIZ_ROOT = Path(os.environ.get('ARCHWIZ_HOME', Path.home())) +ARCHWIZ_DIR = ARCHWIZ_ROOT / 'archwiz' +DEEPCLI_DIR = ARCHWIZ_ROOT / 'deepcli' +SESSION_STORE = ARCHWIZ_ROOT / '.deepcli' / 'session_store' +``` + +This makes the entire system relocatable and testable. + +### B. `fzf` Integration (Shelved → Resolvable) +CONSIDERATIONS.md documents why fzf was shelved: it indexed 194k files without respecting `bloat_exclusions.lst`. The fix is already documented: +```bash +find ~ -type d | grep -vFf bloat_exclusions.lst | fzf +``` +The keyboard issue was Termux-specific and does not apply on Replit. This is ready to implement. + +### C. Real-Time Chat Feedback (ROADMAP Priority 🔴) +The listener executes code blocks but cannot send results back to the conversation. The methodology log proves `stream_completion()` is the correct path (Attempt C). The missing piece is a `report_back(session_id, text)` helper that calls `stream_completion` with the execution result as a user message. + +### D. ChronoMancer Branch-Routing UI (ROADMAP 🟡) +`cli-synthegration/Chronos/accelerator.py` and `versioner.py` have the data layer. What's missing is a TUI visualizer for the branch tree — a read-only `curses` (or rich-text) panel showing fork points and child session previews. + +### E. Self-Healing Sandbox (CONCEPT_INDEX: ❌ Not Built) +The full loop: Sentinel detects a failure → auto-repair attempts a fix → Probe validates → promote if clean. `auto_repair.py` handles the Sentinel REVIEW tier. The gap is the detection→dispatch→promote chain being fully automated without human `[1]` invocation. This is ~50 lines of glue in `autonomous_runner.py`. + +### F. Web Dashboard (Replit-Native Extension) +The cockpit is currently terminal-only (stdin/stdout). On Replit, a lightweight Flask/FastAPI server exposing the same 19 menu actions as REST endpoints, with a minimal HTML dashboard, would make the environment accessible from any browser — including mobile. The pipeline status, activity feed, and live metrics are natural candidates for this. + +### G. Expert-Mode Session Creation (ROADMAP 🟡) +Sessions created without the `thinking_enabled`/`search_enabled` fields default to non-Expert mode. The `create_session()` call in `core.py` should accept and forward these flags, and `cli.py`'s `new` command should expose `--expert / --no-expert`. + +--- + +## Extension Ideas + +| Idea | Effort | Value | +|------|--------|-------| +| Multi-account DeepSeek probing | Medium | Enables parallel task execution on account 2 | +| Cross-session idea harvester | Medium | Scan all exports for novel `#concept` tags across sessions | +| Prompt engine rotation (A/B test) | Low | Validate the CONSIDERATIONS.md prompt-phrase observations empirically | +| Commit notes scanner → CHANGES.md | Low | Auto-detect "what changed" summaries from session digests | +| Tab completion for `/sessions` | Low | Already partially designed in TUI | +| Sigil substitution engine (cedrlang) | High | Runtime compression protocol — reduces token usage | +| Export poller as a Replit workflow | Low | `export_poller.sh` is a natural persistent workflow | + +--- + +## User Preferences + +- Evaluate critically, propose optimizations and extensions +- Preserve existing structure and stack — do not migrate or restructure +- Check recent commits and branches before recommending changes diff --git a/skills-lock.json b/skills-lock.json new file mode 100644 index 0000000000..21e1db9f09 --- /dev/null +++ b/skills-lock.json @@ -0,0 +1,11 @@ +{ + "version": 1, + "skills": { + "find-skills": { + "source": "vercel-labs/skills", + "sourceType": "github", + "skillPath": "skills/find-skills/SKILL.md", + "computedHash": "b146008599c31057cef1c145774cea5d5afb30e8f43fa802e47a4b461419aaaf" + } + } +} From 7ebc9b00288d25f2002cdecccdbd600d6271ba25 Mon Sep 17 00:00:00 2001 From: timerloggedout-spec Date: Fri, 31 Jul 2026 21:18:18 +0000 Subject: [PATCH 3/7] =?UTF-8?q?docs:=20critical=20evaluation=20=E2=80=94?= =?UTF-8?q?=20corrections=20and=20proposals?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Pipeline flow: clarify canonical path is core.py cache-write hook → dispatch_pipeline, not export_poller/activity_listener (legacy paths) - Mark export_poller.sh and activity_listener.py as candidates for archival; proposal A updated accordingly - commingle-swarm: clarify it is a cloned/forked template repo kept for code scavenging, not a first-class project to run or maintain - Termux path fix: replace simple env-var suggestion with an environment-aware intermediary config.py that auto-detects ARCHWIZ_ENV (termux | replit | local) and resolves all root paths from a single import — avoids relative-path ambiguity across different call-site working directories - Remove 'Export poller as Replit workflow' from Extension Ideas (poller is extraneous per user feedback) --- replit.md | 55 +++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 35 insertions(+), 20 deletions(-) diff --git a/replit.md b/replit.md index e9acebdc5c..425db69ece 100644 --- a/replit.md +++ b/replit.md @@ -10,9 +10,9 @@ A personal **agentic development environment** built around the DeepSeek AI API. ### Pipeline Flow (high-level) ``` -User → DeepSeek (via deepcli) → session cache (~/.deepcli/session_store/) - → archwiz/dispatch_pipeline.py (called on every cache write) - → activity_listener.py (extracts + deduplicates code blocks) +User → DeepSeek (via deepcli TUI / cli.py) + → core.py stream_completion() → session cache (~/.deepcli/session_store/) + → dispatch_pipeline.py (called on every cache write, via core.py hook) → autonomous_runner.py / dispatch_task.py (sandboxed execution) → Sentinel (5-gate verification: file integrity, naming, duplicate, probe, shockwave) → promote.py (ascension to true_versions) @@ -21,6 +21,8 @@ User → DeepSeek (via deepcli) → session cache (~/.deepcli/session_store/) → archwiz/archivist.py (query engine over all indices) ``` +> **Note:** `export_poller.sh` and `activity_listener.py` are legacy execution paths — the canonical code-block execution flow runs through the TUI and `core.py`'s cache-write hook (`dispatch_pipeline.py`). The poller/listener represent an earlier, now-superseded approach and should be treated as candidates for removal or archival rather than maintained in parallel. + --- ## How to Run (on Replit) @@ -48,7 +50,32 @@ Almost all `subprocess.run(...)` calls in `archwiz/archwiz.py` use `os.path.expa - Many top-level symlinks (e.g., `dispatch_task.py`, `agent_shell.py`, `archaeologist.py`) point into the Termux filesystem — silently broken on Replit - Large archive files (`archwiz/pointer_inverted.json`, session logs) contain historical Termux paths — low priority but confusing -**Fix:** Introduce `ARCHWIZ_HOME` environment variable (default: `~`). Replace all `~/archwiz/...` string construction with `Path(os.environ.get('ARCHWIZ_HOME', Path.home())) / 'archwiz' / ...`. Create a `config.py` in `archwiz/` that provides this resolution. +> **Key constraint:** Pure relative paths are not a safe fix here — the tools are invoked from different working directories (cockpit, listener, dispatch, TUI), so a relative path resolves differently depending on the call site. The correct solution is an **environment-aware intermediary layer**, not relative paths. + +**Fix:** Create `archwiz/config.py` as a single source of truth for all paths, resolved at import time via an environment variable: + +```python +# archwiz/config.py +import os +from pathlib import Path + +# Set ARCHWIZ_ENV=termux | replit | local (auto-detected if unset) +_env = os.environ.get('ARCHWIZ_ENV', '').lower() +if not _env: + _env = 'termux' if Path('/data/data/com.termux').exists() else 'replit' + +if _env == 'termux': + ARCHWIZ_ROOT = Path('/data/data/com.termux/files/home') +else: + ARCHWIZ_ROOT = Path(os.environ.get('ARCHWIZ_HOME', Path.home())) + +ARCHWIZ_DIR = ARCHWIZ_ROOT / 'archwiz' +DEEPCLI_DIR = ARCHWIZ_ROOT / 'deepcli' +SESSION_STORE = ARCHWIZ_ROOT / '.deepcli' / 'session_store' +WORKSPACE_DIR = ARCHWIZ_ROOT / 'workspace' +``` + +All scripts import from `config.py` instead of constructing paths inline. `ARCHWIZ_ENV` overrides auto-detection for edge cases. This is portable across Termux, Replit, and local Linux without changing any call-site code. ### 2. Silent Exception Swallowing in `core.py` `deepcli/deepcli/core.py:58-59` has a bare `except Exception: pass` around the ArchWiz dispatch call. If the dispatch pipeline fails (missing file, import error, broken path), the failure is completely invisible. The user sees normal operation while the pipeline is dead. @@ -101,26 +128,15 @@ The `archwiz/` directory contains **~25 timestamped `.bak` files** for `archwiz. **Recommendation:** Move all `.bak` files to a `_archive/` folder or delete them. Git history is the canonical backup mechanism. -### commingle-swarm Has No Installed Dependencies -`commingle-swarm/` is a TypeScript/Node project with a `package.json` but no `node_modules/`. It is a self-contained P2P/PWA and appears disconnected from the rest of the monorepo (no import relationships found). It cannot be started without `npm install`. +### commingle-swarm Is a Template / Scavenging Source +`commingle-swarm/` is a **cloned/forked external repo** kept in the monorepo as a structural reference and code-scavenging template, not a first-class project to run or maintain. It is intentionally disconnected from the rest of the monorepo. Treat it as read-only reference material — do not install its dependencies, do not wire it into the pipeline, and do not include it in health checks or index sweeps. --- ## Optimization Proposals -### A. Unified Config Layer -Replace all scattered `os.path.expanduser('~/archwiz/...')` calls (~60+ occurrences in `archwiz.py` alone) with a single import: - -```python -# archwiz/config.py -from pathlib import Path -ARCHWIZ_ROOT = Path(os.environ.get('ARCHWIZ_HOME', Path.home())) -ARCHWIZ_DIR = ARCHWIZ_ROOT / 'archwiz' -DEEPCLI_DIR = ARCHWIZ_ROOT / 'deepcli' -SESSION_STORE = ARCHWIZ_ROOT / '.deepcli' / 'session_store' -``` - -This makes the entire system relocatable and testable. +### A. Retire / Archive `export_poller.sh` and `activity_listener.py` +These are legacy execution paths that predate the current `core.py` cache-write hook → `dispatch_pipeline.py` flow. They duplicate work the TUI already does and introduce a second, less-reliable execution surface. The methodology log documents the pain: 4 listener lifecycle attempts, nohup ghosts, PID-file fragility. The canonical path is: `core.py stream_completion()` writes cache → `dispatch_pipeline.update_all()` → `autonomous_runner`. The listener and poller should be archived (moved to `_archive/`) once the dispatch hook is confirmed stable on Replit. ### B. `fzf` Integration (Shelved → Resolvable) CONSIDERATIONS.md documents why fzf was shelved: it indexed 194k files without respecting `bloat_exclusions.lst`. The fix is already documented: @@ -156,7 +172,6 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default | Commit notes scanner → CHANGES.md | Low | Auto-detect "what changed" summaries from session digests | | Tab completion for `/sessions` | Low | Already partially designed in TUI | | Sigil substitution engine (cedrlang) | High | Runtime compression protocol — reduces token usage | -| Export poller as a Replit workflow | Low | `export_poller.sh` is a natural persistent workflow | --- From 8ed0d490eed68f9ed2c1d811085bce0fff656985 Mon Sep 17 00:00:00 2001 From: timerloggedout-spec Date: Fri, 31 Jul 2026 22:54:29 +0000 Subject: [PATCH 4/7] feat: env-aware config, package init, setup fix, branch evaluations, resolve PR comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit archwiz/config.py (extended from mistral/fixes-config-security): - Add ARCHWIZ_DIR, DEEPCLI_DIR, WORKSPACE_DIR, LOG_DIR path properties (the paths archwiz.py actually calls — previously missing) - Fix Replit detection: REPL_OWNER → REPL_ID / REPLIT_DOMAINS / REPLIT_DB_URL - ARCHWIZ_ENV shell override takes highest priority over saved config - Module-level flat constants (ARCHWIZ_DIR etc.) as drop-in replacements for all os.path.expanduser('~/archwiz/...') call sites - API-compat convenience functions preserved (get_tokens_dir etc.) archwiz/__init__.py (new): - Makes 'from archwiz import config' and 'from archwiz.config import X' work regardless of caller working directory setup.sh (fixed from mistral/fixes-config-security): - Environment-aware: venv only for local; system pip for Replit and Termux - Validates archwiz.config import and prints resolved paths on success - PYTHONPATH set so import works without installing the package requirements-base.txt, SECURITY.md: landed from mistral/fixes-config-security replit.md: - Resolve PR comments: add 'text' language tag to two bare code fences (MD040) - Proposal F (REST dashboard): add concrete security requirements before implementation (auth, CSRF, origin allowlist, rate-limit, audit log) - Critical evaluation of mistral/fixes-config-security branch with gap table - Critical evaluation of vibe/mistralai-vibe-code-wrapper-6055d2 branch with gap table and expansion recommendations - Issue #6 (no deps): updated to reflect partial resolution + remaining gaps --- SECURITY.md | 16 ++++ archwiz/__init__.py | 2 + archwiz/config.py | 196 ++++++++++++++++++++++++++++++++++++++++++ replit.md | 82 ++++++++++++++++-- requirements-base.txt | 5 ++ setup.sh | 64 ++++++++++++++ 6 files changed, 357 insertions(+), 8 deletions(-) create mode 100644 SECURITY.md create mode 100644 archwiz/__init__.py create mode 100644 archwiz/config.py create mode 100644 requirements-base.txt create mode 100755 setup.sh diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..0251c73cfc --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,16 @@ +# Security and responsible use + +This repository contains helpers that interact with external Web chat providers (e.g., Mistral). +Some tools in the repository are convenience scripts for local use only and may read or write +sensitive artifacts such as cookies, bearer tokens, or session exports. + +Guidelines +- Do NOT commit tokens, cookie files, or other credentials into the repository. +- Any script that interacts with credentials must be run deliberately by an operator, and only + after they have reviewed the code and understand the legal and ToS implications. +- Tools that capture or manipulate credentials are placed under tools/harvesters/credentialing_optin/ + and require explicit opt-in (see README in that folder). +- All token/cookie files are written with restrictive permissions (600) and directories with 700. + +If you find secrets accidentally committed to the repo, follow the GitHub guidance for removing +secrets from history and rotate the credentials immediately. diff --git a/archwiz/__init__.py b/archwiz/__init__.py new file mode 100644 index 0000000000..527a0d3f13 --- /dev/null +++ b/archwiz/__init__.py @@ -0,0 +1,2 @@ +# archwiz package — makes `from archwiz import config` work +# regardless of the caller's working directory. diff --git a/archwiz/config.py b/archwiz/config.py new file mode 100644 index 0000000000..326606d2e6 --- /dev/null +++ b/archwiz/config.py @@ -0,0 +1,196 @@ +from pathlib import Path +import os +import json + +# archwiz/config.py +# Environment-aware configuration for ArchWiz / termux-monorepo. +# Single source of truth for all runtime paths — import this instead of +# hard-coding os.path.expanduser('~/archwiz/...') at every call site. +# +# Environments detected (in priority order): +# termux — /data/data/com.termux exists on the filesystem +# replit — REPL_ID or REPLIT_DOMAINS env var is present +# local — everything else (Linux desktop, CI, etc.) +# +# Override detection with ARCHWIZ_ENV=termux|replit|local in the shell, +# or by writing {"archwiz_env": "..."} to ~/.archwiz/config.json. + +HOME = Path.home() + +USER_CONFIG_DIR = HOME / ".archwiz" +USER_CONFIG_FILE = USER_CONFIG_DIR / "config.json" + +# Defaults — all overridable via ~/.archwiz/config.json or ARCHWIZ_ENV +_defaults: dict = { + "archwiz_env": "auto", # auto | termux | replit | local + "archwiz_root": None, # None → auto-detected from env + "multi_ai_tokens_dir": str(HOME / ".multi-ai-tokens"), + "session_store": str(HOME / ".deepcli" / "session_store"), + "log_dir": str(HOME / ".archwiz" / "logs"), +} + + +class Config: + def __init__(self): + USER_CONFIG_DIR.mkdir(mode=0o700, parents=True, exist_ok=True) + self._cfg = dict(_defaults) + + # Load persisted user config, silently retire broken files + if USER_CONFIG_FILE.exists(): + try: + data = json.loads(USER_CONFIG_FILE.read_text()) + if isinstance(data, dict): + self._cfg.update(data) + except Exception: + try: + USER_CONFIG_FILE.rename(USER_CONFIG_FILE.with_suffix(".broken")) + except Exception: + pass + + # Shell override takes highest priority + shell_env = os.environ.get("ARCHWIZ_ENV", "").strip().lower() + if shell_env in ("termux", "replit", "local"): + self._cfg["archwiz_env"] = shell_env + + self._apply_auto_detection() + + # ------------------------------------------------------------------ + # Internal helpers + # ------------------------------------------------------------------ + + def _apply_auto_detection(self): + ev = self._cfg.get("archwiz_env", "auto") + if ev == "auto": + if Path("/data/data/com.termux").exists(): + ev = "termux" + elif ( + os.environ.get("REPL_ID") + or os.environ.get("REPLIT_DOMAINS") + or os.environ.get("REPLIT_DB_URL") + ): + ev = "replit" + else: + ev = "local" + self._cfg["archwiz_env"] = ev + + if not self._cfg.get("archwiz_root"): + if ev == "termux": + self._cfg["archwiz_root"] = "/data/data/com.termux/files/home" + else: + self._cfg["archwiz_root"] = str(HOME) + + self._cfg.setdefault("multi_ai_tokens_dir", _defaults["multi_ai_tokens_dir"]) + self._cfg.setdefault("session_store", _defaults["session_store"]) + self._cfg.setdefault("log_dir", _defaults["log_dir"]) + + def _mkdir(self, p: Path, mode: int = 0o700) -> Path: + p.mkdir(mode=mode, parents=True, exist_ok=True) + return p + + # ------------------------------------------------------------------ + # Persistence + # ------------------------------------------------------------------ + + def save(self): + USER_CONFIG_FILE.write_text(json.dumps(self._cfg, indent=2)) + USER_CONFIG_FILE.chmod(0o600) + + def get(self, key, default=None): + return self._cfg.get(key, default) + + def set(self, key, value): + self._cfg[key] = value + self.save() + + # ------------------------------------------------------------------ + # Core path properties — used by archwiz.py and all sub-tools + # ------------------------------------------------------------------ + + @property + def archwiz_env(self) -> str: + return self._cfg.get("archwiz_env", "local") + + @property + def archwiz_root(self) -> Path: + """Root home directory for this environment.""" + return Path(self._cfg["archwiz_root"]) + + @property + def ARCHWIZ_DIR(self) -> Path: + """~/archwiz/ — cockpit, listener, sentinel, etc.""" + return self._mkdir(self.archwiz_root / "archwiz") + + @property + def DEEPCLI_DIR(self) -> Path: + """~/deepcli/ — DeepSeek CLI package.""" + return self.archwiz_root / "deepcli" + + @property + def WORKSPACE_DIR(self) -> Path: + """~/workspace/ — llm_map, provenance, etc.""" + return self.archwiz_root / "workspace" + + @property + def SESSION_STORE(self) -> Path: + """~/.deepcli/session_store/ — per-session JSON cache.""" + p = Path(self._cfg["session_store"]) + self._mkdir(p.parent) + self._mkdir(p) + return p + + @property + def MULTI_AI_TOKENS_DIR(self) -> Path: + """~/.multi-ai-tokens/ — bearer tokens for all AI providers.""" + return self._mkdir(Path(self._cfg["multi_ai_tokens_dir"])) + + @property + def LOG_DIR(self) -> Path: + """~/.archwiz/logs/ — pipeline + debug logs.""" + return self._mkdir(Path(self._cfg["log_dir"])) + + +# --------------------------------------------------------------------------- +# Module-level singleton — import and use directly: +# from archwiz.config import ARCHWIZ_DIR, SESSION_STORE +# from archwiz import config as cfg; cfg.ARCHWIZ_DIR +# --------------------------------------------------------------------------- + +_config = Config() + +# Flat convenience constants — drop-in replacements for expanduser() calls +ARCHWIZ_DIR = _config.ARCHWIZ_DIR +DEEPCLI_DIR = _config.DEEPCLI_DIR +WORKSPACE_DIR = _config.WORKSPACE_DIR +SESSION_STORE = _config.SESSION_STORE +MULTI_AI_TOKENS_DIR = _config.MULTI_AI_TOKENS_DIR +LOG_DIR = _config.LOG_DIR +ARCHWIZ_ENV = _config.archwiz_env +ARCHWIZ_ROOT = _config.archwiz_root + + +# --------------------------------------------------------------------------- +# Convenience functions — kept for API compat with mistral/fixes-config-security +# --------------------------------------------------------------------------- + +def get_tokens_dir() -> Path: + return _config.MULTI_AI_TOKENS_DIR + + +def get_session_store() -> Path: + return _config.SESSION_STORE + + +def set_tokens_dir(path): + _config.set("multi_ai_tokens_dir", str(path)) + + +def set_session_store(path): + _config.set("session_store", str(path)) + + +def ensure_dirs(): + """Pre-create all runtime directories. Call once at startup.""" + _ = _config.ARCHWIZ_DIR + _ = _config.SESSION_STORE + _ = _config.MULTI_AI_TOKENS_DIR + _ = _config.LOG_DIR diff --git a/replit.md b/replit.md index 425db69ece..3bd4f38d4b 100644 --- a/replit.md +++ b/replit.md @@ -9,7 +9,7 @@ A personal **agentic development environment** built around the DeepSeek AI API. The system closes a loop: the user chats with DeepSeek via a terminal CLI (`deepcli`), the ArchWiz cockpit auto-detects and executes code blocks from those conversations, results feed back into the knowledge graph, and a suite of forensic/verification tools (Sentinel, Archivist, Mirror, Dangle Detector) maintain quality and provenance. ### Pipeline Flow (high-level) -``` +```text User → DeepSeek (via deepcli TUI / cli.py) → core.py stream_completion() → session cache (~/.deepcli/session_store/) → dispatch_pipeline.py (called on every cache write, via core.py hook) @@ -102,19 +102,19 @@ except Exception: ### 5. Broken Symlinks at Root Multiple top-level symlinks are permanently broken on any non-Termux host: -``` -dispatch_task.py → /data/data/com.termux/files/home/workspace/llm_map/dispatch_task.py -agent_shell.py → /data/data/com.termux/.../agent_shell.py -archaeologist.py → /data/data/com.termux/.../archaeologist.py +```text +dispatch_task.py → /data/data/com.termux/files/home/workspace/llm_map/dispatch_task.py +agent_shell.py → /data/data/com.termux/.../agent_shell.py +archaeologist.py → /data/data/com.termux/.../archaeologist.py enforce_hierarchy.sh → /data/data/com.termux/.../enforce_workspace_hierarchy.sh ``` **Fix:** Either replace symlinks with relative path symlinks (pointing into `archwiz/` or `cli-synthegration/workspace/`) or remove them and update callers to use the canonical paths. -### 6. No Dependency Declaration -No `requirements.txt` exists. The Python environment depends on Termux `pkg` installs of: `curl_cffi`, `requests`, `ruff`, `ripgrep`, `fd`, `shellcheck`, `jq`, `entr`. On Replit, these must be installed explicitly. +### 6. No Dependency Declaration *(partially resolved — see Branch Evaluations below)* +~~No `requirements.txt` exists.~~ `requirements-base.txt` and `setup.sh` now exist (landed in `mistral/fixes-config-security`). Remaining gap: `requirements-base.txt` covers only `curl-cffi`, `requests`, `websockets` — system tools (`ruff`, `ripgrep`, `fd`, `shellcheck`, `jq`, `entr`) still require manual install. `multi-ai-cli/requirements.txt` exists independently but is not reconciled with the root baseline. -**Fix:** Create `requirements.txt` at the root with all Python deps. Add a `setup.sh` that installs system tools via `nix` or the package skill. +**Fix remaining:** Add system-tool installation to `setup.sh` via `nix-env` or document them in a `PREREQUISITES.md`. Reconcile `multi-ai-cli/requirements.txt` with `requirements-base.txt` — avoid two separate dependency tracks diverging silently. --- @@ -157,6 +157,15 @@ The full loop: Sentinel detects a failure → auto-repair attempts a fix → Pro ### F. Web Dashboard (Replit-Native Extension) The cockpit is currently terminal-only (stdin/stdout). On Replit, a lightweight Flask/FastAPI server exposing the same 19 menu actions as REST endpoints, with a minimal HTML dashboard, would make the environment accessible from any browser — including mobile. The pipeline status, activity feed, and live metrics are natural candidates for this. +**Security requirements before any REST implementation:** +- Bind to `127.0.0.1` only (never `0.0.0.0`) unless behind the Replit proxy +- Require a session token (env-var seeded, checked on every request via middleware) +- CSRF protection on all state-mutating endpoints (e.g., double-submit cookie or `SameSite=Strict`) +- Origin allowlist (only the Replit preview domain) +- Rate-limit all endpoints — especially `[1]` (Full Autonomous Run), which triggers heavy workloads +- Emit an audit log entry (timestamp, action, result) for every invocation; persist to `LOG_DIR` +- Least-privilege: read-only endpoints (status, feed, metrics) available without elevated scope; execution endpoints require an explicit capability flag + ### G. Expert-Mode Session Creation (ROADMAP 🟡) Sessions created without the `thinking_enabled`/`search_enabled` fields default to non-Expert mode. The `create_session()` call in `core.py` should accept and forward these flags, and `cli.py`'s `new` command should expose `--expert / --no-expert`. @@ -175,6 +184,63 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default --- +--- + +## Branch Evaluations + +### `mistral/fixes-config-security` — env-aware config, bridge hardening, security docs +*Author: timerloggedout-spec. 9 files, +297/−27 lines.* + +**What it does well:** +- `archwiz/config.py` — persistent JSON config at `~/.archwiz/config.json`, proper directory/file permissions (700/600), graceful corruption handling (renames to `.broken`), atomic token writes (temp-file + `os.replace`) +- `multi-ai-cli/bridge/mistral_bridge.py` — now imports from `archwiz.config`; atomic token write with secure perms +- `tools/tests/mistral_bridge_smoke.py` — smoke test that is safe (no external calls, cleans up after itself) +- `SECURITY.md` and harvester READMEs — explicit opt-in model for credential tooling +- `requirements-base.txt` + `setup.sh` — fills the missing dependency declaration gap + +**Critical gaps (fixed in this branch on `critical-proposal`):** + +| Gap | Severity | Fix applied | +|-----|----------|-------------| +| Missing `ARCHWIZ_DIR`, `DEEPCLI_DIR`, `WORKSPACE_DIR` — the paths archwiz.py actually calls | 🔴 High | Added as `@property` on `Config` + module-level constants | +| Replit detection used `REPL_OWNER` (unreliable) | 🟡 Medium | Updated to `REPL_ID` / `REPLIT_DOMAINS` / `REPLIT_DB_URL` | +| No `archwiz/__init__.py` — `from archwiz import config` fails | 🔴 High | Created `archwiz/__init__.py` | +| `setup.sh` creates a venv — breaks on Replit (no venv support) | 🔴 High | Replaced with env-aware install: venv only for `local`, system pip for Replit/Termux | +| Module-level constants missing — callers need `from archwiz.config import ARCHWIZ_DIR` | 🟡 Medium | Added flat module-level constants as drop-in replacements | +| `multi-ai-cli/core/core.py` dispatch hook copies the silent `except: pass` bug | 🔴 High | Not yet fixed — tracked in task #3 | + +**Verdict:** Merge-ready after the fixes above. The config design is sound. The bridge hardening and security documentation are genuine improvements. + +--- + +### `vibe/mistralai-vibe-code-wrapper-6055d2` — MistralAI CLI + Codex-style code harvester +*Author: Vibe Nuage Agent / timerloggedout-spec co-authored. 22 files, +1072/−643 lines.* + +**What it does well:** +- Complete MistralAI CLI mirroring the DeepSeek/cli-synthegration pattern end-to-end +- `code_harvester.py` — content-addressable blob store (SHA256, first 16 chars), `Pointer` class, hierarchical taxonomy (`language → project → session`), dedup by hash — directly ports the cli-synthegration Codex pattern +- 31 tests passing; regex-only extraction (no BeautifulSoup dependency) +- Dispatch hook plumbed into `multi-ai-cli/core/core.py` — same pipeline integration as deepcli + +**Critical gaps:** + +| Gap | Severity | Recommendation | +|-----|----------|----------------| +| `multi-ai-cli/core/core.py` uses hardcoded `~/.mistralai-cli/` paths — ignores `archwiz/config.py` for its own storage | 🟡 Medium | Replace with `from archwiz.config import SESSION_STORE` or a parallel `MISTRALAI_SESSION_STORE` constant in config.py | +| Dispatch hook (`core.py:64-65`) is `except Exception: pass` — copies the deepcli silent-failure bug | 🔴 High | Log to stderr; tracked in task #3 | +| `multi-ai-cli/requirements.txt` is independent — not reconciled with `requirements-base.txt` | 🟡 Medium | Merge or reference from root baseline | +| `WASM_SOLVER` path constructed relative to `__file__` — will break if CLI is invoked from outside the package | 🟡 Medium | Resolve via `archwiz.config.DEEPCLI_DIR` or a package-local `__file__`-relative path with an existence check | +| No equivalent of `archwiz/sentinel.py` or `archwiz/probe.py` for Mistral output — verification absent | 🟢 Low | Future: extend Sentinel to validate multi-ai-cli executions | + +**What to expand:** +- Add `MISTRALAI_SESSION_STORE`, `MISTRALAI_TOKENS_DIR` to `archwiz/config.py` so all AI providers share one config root +- `code_harvester.py`'s taxonomy is richer than cli-synthegration's — port the `TaxonomyNode.search()` back to the DeepSeek codex (`cli-synthegration/codex/`) +- The harvester's blob store is an ideal foundation for the **cross-session idea harvester** extension (Extension Ideas table) — add a `#concept` tag scanner on top of it + +**Verdict:** High-value addition. The Codex port is well-executed. Fix the silent dispatch hook and reconcile storage paths before merging to master. + +--- + ## User Preferences - Evaluate critically, propose optimizations and extensions diff --git a/requirements-base.txt b/requirements-base.txt new file mode 100644 index 0000000000..695d57ed66 --- /dev/null +++ b/requirements-base.txt @@ -0,0 +1,5 @@ +# Minimal runtime requirements (base) +# Keep this small: core libs required for parser and bridge smoke tests +curl-cffi +requests +websockets diff --git a/setup.sh b/setup.sh new file mode 100755 index 0000000000..54d7af0047 --- /dev/null +++ b/setup.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash +# setup.sh — bootstrap ArchWiz dependencies across environments. +# Supports: Replit (no venv), Termux (no venv), local Linux/macOS (venv). +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + +# ---------- Detect environment ---------- +_detect_env() { + if [ -d /data/data/com.termux ]; then + echo "termux" + elif [ -n "${REPL_ID:-}" ] || [ -n "${REPLIT_DOMAINS:-}" ] || [ -n "${REPLIT_DB_URL:-}" ]; then + echo "replit" + else + echo "local" + fi +} +ARCHWIZ_ENV="${ARCHWIZ_ENV:-$(_detect_env)}" +echo "Environment detected: $ARCHWIZ_ENV" + +# ---------- Install Python deps ---------- +case "$ARCHWIZ_ENV" in + termux) + # Termux: pkg provides ruff; install Python libs system-wide + echo "Installing Python libs (Termux)..." + pip install --quiet --upgrade pip + pip install --quiet -r "$SCRIPT_DIR/requirements-base.txt" + ;; + replit) + # Replit: no venv support; install directly to the Nix/system Python. + # pip install --user is also acceptable here. + echo "Installing Python libs (Replit)..." + pip install --quiet --upgrade pip + pip install --quiet -r "$SCRIPT_DIR/requirements-base.txt" + ;; + *) + # Local: use a venv to avoid polluting the system Python + echo "Installing Python libs (local venv)..." + VENV="$SCRIPT_DIR/.venv" + if [ ! -d "$VENV" ]; then + python3 -m venv "$VENV" + fi + # shellcheck source=/dev/null + source "$VENV/bin/activate" + pip install --quiet --upgrade pip + pip install --quiet -r "$SCRIPT_DIR/requirements-base.txt" + echo " Activate with: source .venv/bin/activate" + ;; +esac + +# ---------- Validate archwiz.config imports ---------- +echo "Validating archwiz.config..." +PYTHONPATH="$SCRIPT_DIR" python3 - <<'PY' +from archwiz import config as aw_config +from archwiz.config import ARCHWIZ_DIR, SESSION_STORE, MULTI_AI_TOKENS_DIR +print(f" env: {aw_config.ARCHWIZ_ENV}") +print(f" archwiz_root: {aw_config.ARCHWIZ_ROOT}") +print(f" ARCHWIZ_DIR: {ARCHWIZ_DIR}") +print(f" SESSION_STORE: {SESSION_STORE}") +print(f" TOKENS_DIR: {MULTI_AI_TOKENS_DIR}") +PY + +echo "Done." +echo "For heavy dependencies (flair, torch, watchexec, hyperfine), install them separately in an x86_64 environment." From 637a0c4b695b220084a048e0f4b250bad975f223 Mon Sep 17 00:00:00 2001 From: timerloggedout-spec Date: Fri, 31 Jul 2026 17:23:02 -0700 Subject: [PATCH 5/7] ChatGPT links with proposal notes User manually Added ChatGPT shared links for improved proposal structure. --- docs/proposals/ChatGPT_droidApp.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 docs/proposals/ChatGPT_droidApp.md diff --git a/docs/proposals/ChatGPT_droidApp.md b/docs/proposals/ChatGPT_droidApp.md new file mode 100644 index 0000000000..b1fdb4f42f --- /dev/null +++ b/docs/proposals/ChatGPT_droidApp.md @@ -0,0 +1,9 @@ +User manual copy share Links to Repository && Commit/PR Evaluation. + +# consider better proposals 📂 directory locations. + +Initial +[link-1](https://chatgpt.com/s/t_6a6d3a3b2a308191981b5877ea748ed4) + +with PR Branch Commit review +[link-2](https://chatgpt.com/s/t_6a6d3a0c17e48191a470ddf338780387) From 2bc964b447950d864d851ff2187e0509de9e5c95 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 00:31:34 +0000 Subject: [PATCH 6/7] fix: apply CodeRabbit auto-fixes Fixed 3 file(s) based on 4 unresolved review comments. Co-authored-by: CodeRabbit --- SECURITY.md | 4 ++-- archwiz/config.py | 8 +++++--- replit.md | 6 +++--- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0251c73cfc..5bda9a744e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -5,12 +5,12 @@ Some tools in the repository are convenience scripts for local use only and may sensitive artifacts such as cookies, bearer tokens, or session exports. Guidelines -- Do NOT commit tokens, cookie files, or other credentials into the repository. +- Do NOT commit tokens, cookie files, session exports, or other credentials into the repository. - Any script that interacts with credentials must be run deliberately by an operator, and only after they have reviewed the code and understand the legal and ToS implications. - Tools that capture or manipulate credentials are placed under tools/harvesters/credentialing_optin/ and require explicit opt-in (see README in that folder). -- All token/cookie files are written with restrictive permissions (600) and directories with 700. +- Token files, cookie files, and session exports MUST use 600 permissions; directories MUST use 700 permissions. If you find secrets accidentally committed to the repo, follow the GitHub guidance for removing secrets from history and rotate the credentials immediately. diff --git a/archwiz/config.py b/archwiz/config.py index 326606d2e6..f85ee0107b 100644 --- a/archwiz/config.py +++ b/archwiz/config.py @@ -41,11 +41,13 @@ def __init__(self): data = json.loads(USER_CONFIG_FILE.read_text()) if isinstance(data, dict): self._cfg.update(data) - except Exception: + except (OSError, json.JSONDecodeError) as e: + import sys + print(f"[config] Failed to load {USER_CONFIG_FILE}: {e}", file=sys.stderr, flush=True) try: USER_CONFIG_FILE.rename(USER_CONFIG_FILE.with_suffix(".broken")) - except Exception: - pass + except OSError as rename_err: + print(f"[config] Failed to rename broken config: {rename_err}", file=sys.stderr, flush=True) # Shell override takes highest priority shell_env = os.environ.get("ARCHWIZ_ENV", "").strip().lower() diff --git a/replit.md b/replit.md index 3bd4f38d4b..015bdd6818 100644 --- a/replit.md +++ b/replit.md @@ -198,7 +198,7 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default - `SECURITY.md` and harvester READMEs — explicit opt-in model for credential tooling - `requirements-base.txt` + `setup.sh` — fills the missing dependency declaration gap -**Critical gaps (fixed in this branch on `critical-proposal`):** +**Critical gaps (fixes applied on `master`):** | Gap | Severity | Fix applied | |-----|----------|-------------| @@ -209,7 +209,7 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default | Module-level constants missing — callers need `from archwiz.config import ARCHWIZ_DIR` | 🟡 Medium | Added flat module-level constants as drop-in replacements | | `multi-ai-cli/core/core.py` dispatch hook copies the silent `except: pass` bug | 🔴 High | Not yet fixed — tracked in task #3 | -**Verdict:** Merge-ready after the fixes above. The config design is sound. The bridge hardening and security documentation are genuine improvements. +**Verdict:** Merging is conditional on completing task #3 (silent dispatch failure). The config design is sound. The bridge hardening and security documentation are genuine improvements. --- @@ -229,7 +229,7 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default | `multi-ai-cli/core/core.py` uses hardcoded `~/.mistralai-cli/` paths — ignores `archwiz/config.py` for its own storage | 🟡 Medium | Replace with `from archwiz.config import SESSION_STORE` or a parallel `MISTRALAI_SESSION_STORE` constant in config.py | | Dispatch hook (`core.py:64-65`) is `except Exception: pass` — copies the deepcli silent-failure bug | 🔴 High | Log to stderr; tracked in task #3 | | `multi-ai-cli/requirements.txt` is independent — not reconciled with `requirements-base.txt` | 🟡 Medium | Merge or reference from root baseline | -| `WASM_SOLVER` path constructed relative to `__file__` — will break if CLI is invoked from outside the package | 🟡 Medium | Resolve via `archwiz.config.DEEPCLI_DIR` or a package-local `__file__`-relative path with an existence check | +| `WASM_SOLVER` path constructed relative to `__file__` — solver target may be missing or resolve to incorrect package-relative location | 🟡 Medium | Resolve via `archwiz.config.DEEPCLI_DIR` or a package-local `__file__`-relative path with an existence check | | No equivalent of `archwiz/sentinel.py` or `archwiz/probe.py` for Mistral output — verification absent | 🟢 Low | Future: extend Sentinel to validate multi-ai-cli executions | **What to expand:** From 26feda1db8c0e6f815876ee0b2eaab2382a5a388 Mon Sep 17 00:00:00 2001 From: timerloggedout-spec Date: Sat, 1 Aug 2026 08:37:43 -0700 Subject: [PATCH 7/7] fix: resolve remaining CodeRabbit threads on PR #1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - skills-lock: correct find-skills computedHash - .replit: move Nix channel off EOL stable-25_05 → stable-26_05 - SKILL.md: pin npx skills@version, project-local default, no -g -y without approval; language tags on prose fences - replit.md: credentials secure-storage note; ARCHWIZ_ENV detection matches config.py; fzf prune; report_back via canonical path; WASM_SOLVER accuracy - ChatGPT_droidApp.md: clear heading + intro --- .agents/skills/find-skills/SKILL.md | 74 ++++++++++++++--------------- .replit | 2 +- docs/proposals/ChatGPT_droidApp.md | 11 ++--- replit.md | 38 ++++++++++----- skills-lock.json | 2 +- 5 files changed, 69 insertions(+), 58 deletions(-) diff --git a/.agents/skills/find-skills/SKILL.md b/.agents/skills/find-skills/SKILL.md index a41bdd074b..8309948e74 100644 --- a/.agents/skills/find-skills/SKILL.md +++ b/.agents/skills/find-skills/SKILL.md @@ -20,13 +20,19 @@ Use this skill when the user: ## What is the Skills CLI? -The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools. +The Skills CLI (`npx skills@1.0.0` or the version pinned in `skills-lock.json`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools. -**Key commands:** +**Key commands (always pin the CLI version):** -- `npx skills find [query] [--owner ]` - Search for skills interactively or by keyword, optionally scoped to a GitHub owner -- `npx skills add ` - Install a skill from GitHub or other sources -- `npx skills update` - Update all installed skills +- `npx skills@1.0.0 find [query] [--owner ]` — Search for skills interactively or by keyword +- `npx skills@1.0.0 add ` — Install a skill **project-locally** by default (no global flag) +- `npx skills@1.0.0 update` — Update installed skills in the current project + +**Security rules:** + +- Pin every `npx skills@...` invocation to an explicit version (see `skills-lock.json` / approved release). +- Default install scope is **project-local**. Do not use `--global` / `-g` or non-interactive `--yes` / `-y` unless the user explicitly approves that scope and mode. +- Do not treat install counts, GitHub stars, or source reputation as security validation. **Browse skills at:** https://skills.sh/ @@ -42,65 +48,57 @@ When a user asks for help with something, identify: ### Step 2: Check the Leaderboard First -Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) to see if a well-known skill already exists for the domain. The leaderboard ranks skills by total installs, surfacing the most popular and battle-tested options. - -For example, top skills for web development include: -- `vercel-labs/agent-skills` — React, Next.js, web design (100K+ installs each) -- `anthropics/skills` — Frontend design, document processing (100K+ installs) +Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) for well-known skills in the domain. Rankings can help discovery but are **not** a security signal. ### Step 3: Search for Skills -If the leaderboard doesn't cover the user's need, run the find command: +If the leaderboard doesn't cover the user's need, run the find command with a pinned version: ```bash -npx skills find [query] [--owner ] +npx skills@1.0.0 find [query] [--owner ] ``` For example: -- User asks "how do I make my React app faster?" → `npx skills find react performance` -- User asks "can you help me with PR reviews?" → `npx skills find pr review` -- User asks "I need to create a changelog" → `npx skills find changelog` - -### Step 4: Verify Quality Before Recommending +- User asks "how do I make my React app faster?" → `npx skills@1.0.0 find react performance` +- User asks "can you help me with PR reviews?" → `npx skills@1.0.0 find pr review` +- User asks "I need to create a changelog" → `npx skills@1.0.0 find changelog` -**Do not recommend a skill based solely on search results.** Always verify: +### Step 4: Review Before Recommending -1. **Install count** — Prefer skills with 1K+ installs. Be cautious with anything under 100. -2. **Source reputation** — Official sources (`vercel-labs`, `anthropics`, `microsoft`) are more trustworthy than unknown authors. -3. **GitHub stars** — Check the source repository. A skill from a repo with <100 stars should be treated with skepticism. +**Do not recommend a skill based solely on search results.** Review the skill source, license, and contents. Prefer official or known maintainers when possible, but always require explicit user approval before install. ### Step 5: Present Options to the User -When you find relevant skills, present them to the user with: +When you find relevant skills, present them with: 1. The skill name and what it does -2. The install count and source -3. The install command they can run +2. The source repository +3. The **project-local** install command (pinned version) 4. A link to learn more at skills.sh Example response: -``` -I found a skill that might help! The "react-best-practices" skill provides -React and Next.js performance optimization guidelines from Vercel Engineering. -(185K installs) +```text +I found a skill that might help: "react-best-practices" from vercel-labs/agent-skills. -To install it: -npx skills add vercel-labs/agent-skills@react-best-practices +To install it project-locally (pinned CLI): +npx skills@1.0.0 add vercel-labs/agent-skills@react-best-practices Learn more: https://skills.sh/vercel-labs/agent-skills/react-best-practices + +Say if you want global install or non-interactive flags — those require explicit approval. ``` -### Step 6: Offer to Install +### Step 6: Offer to Install (with approval) -If the user wants to proceed, you can install the skill for them: +If the user wants to proceed, install **project-locally** by default: ```bash -npx skills add -g -y +npx skills@1.0.0 add ``` -The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. +Only add `--global` / `-g` or `--yes` / `-y` when the user has explicitly approved global scope or non-interactive execution. ## Common Skill Categories @@ -120,7 +118,7 @@ When searching, consider these common categories: 1. **Use specific keywords**: "react testing" is better than just "testing" 2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd" -3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills` +3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or similar collections — still review before install ## When No Skills Are Found @@ -128,14 +126,14 @@ If no relevant skills exist: 1. Acknowledge that no existing skill was found 2. Offer to help with the task directly using your general capabilities -3. Suggest the user could create their own skill with `npx skills init` +3. Suggest the user could create their own skill with a pinned init command Example: -``` +```text I searched for skills related to "xyz" but didn't find any matches. I can still help you with this task directly! Would you like me to proceed? If this is something you do often, you could create your own skill: -npx skills init my-xyz-skill +npx skills@1.0.0 init my-xyz-skill ``` diff --git a/.replit b/.replit index 416c2b6be0..05dc727bd0 100644 --- a/.replit +++ b/.replit @@ -1,7 +1,7 @@ modules = ["python-3.12", "bash", "web", "nodejs-20", "rust-stable"] [nix] -channel = "stable-25_05" +channel = "stable-26_05" [agent] expertMode = true diff --git a/docs/proposals/ChatGPT_droidApp.md b/docs/proposals/ChatGPT_droidApp.md index b1fdb4f42f..1129a24bd9 100644 --- a/docs/proposals/ChatGPT_droidApp.md +++ b/docs/proposals/ChatGPT_droidApp.md @@ -1,9 +1,8 @@ -User manual copy share Links to Repository && Commit/PR Evaluation. +# Repository and Commit/PR Evaluation Links -# consider better proposals 📂 directory locations. +This document contains shared links for repository and commit/PR evaluations. -Initial -[link-1](https://chatgpt.com/s/t_6a6d3a3b2a308191981b5877ea748ed4) +> **Note:** Reconsider the directory location for proposal documents under `docs/proposals/`. -with PR Branch Commit review -[link-2](https://chatgpt.com/s/t_6a6d3a0c17e48191a470ddf338780387) +- [Initial repository evaluation](https://chatgpt.com/s/t_6a6d3a3b2a308191981b5877ea748ed4) +- [PR branch commit review](https://chatgpt.com/s/t_6a6d3a0c17e48191a470ddf338780387) diff --git a/replit.md b/replit.md index 015bdd6818..4a2683ace8 100644 --- a/replit.md +++ b/replit.md @@ -35,7 +35,7 @@ python3 deepcli/deepcli.py new # Start a new DeepSeek session python3 deepcli/deepcli.py send "prompt here" ``` -The DeepSeek integration requires a valid `ds_session_id` cookie and bearer token extracted from a browser session (see `deepcli/extract-token.js`). +The DeepSeek integration requires a valid `ds_session_id` cookie and bearer token extracted from a browser session (see `deepcli/extract-token.js`). **Store these only in Replit Secrets or environment variables** — never commit or echo them, redact them from logs and exports, and revoke immediately if exposed. --- @@ -55,14 +55,23 @@ Almost all `subprocess.run(...)` calls in `archwiz/archwiz.py` use `os.path.expa **Fix:** Create `archwiz/config.py` as a single source of truth for all paths, resolved at import time via an environment variable: ```python -# archwiz/config.py +# archwiz/config.py (summary — see landed implementation on this branch) import os from pathlib import Path -# Set ARCHWIZ_ENV=termux | replit | local (auto-detected if unset) +# ARCHWIZ_ENV=termux | replit | local (explicit) or auto-detect +# Detection: Termux via /data/data/com.termux; Replit via REPL_ID / REPLIT_DOMAINS / REPLIT_DB_URL; +# otherwise local. Reject unknown explicit values. _env = os.environ.get('ARCHWIZ_ENV', '').lower() -if not _env: - _env = 'termux' if Path('/data/data/com.termux').exists() else 'replit' +if not _env or _env == 'auto': + if Path('/data/data/com.termux').exists(): + _env = 'termux' + elif os.environ.get('REPL_ID') or os.environ.get('REPLIT_DOMAINS') or os.environ.get('REPLIT_DB_URL'): + _env = 'replit' + else: + _env = 'local' +elif _env not in ('termux', 'replit', 'local'): + raise ValueError(f'Unknown ARCHWIZ_ENV: {_env}') if _env == 'termux': ARCHWIZ_ROOT = Path('/data/data/com.termux/files/home') @@ -139,14 +148,19 @@ The `archwiz/` directory contains **~25 timestamped `.bak` files** for `archwiz. These are legacy execution paths that predate the current `core.py` cache-write hook → `dispatch_pipeline.py` flow. They duplicate work the TUI already does and introduce a second, less-reliable execution surface. The methodology log documents the pain: 4 listener lifecycle attempts, nohup ghosts, PID-file fragility. The canonical path is: `core.py stream_completion()` writes cache → `dispatch_pipeline.update_all()` → `autonomous_runner`. The listener and poller should be archived (moved to `_archive/`) once the dispatch hook is confirmed stable on Replit. ### B. `fzf` Integration (Shelved → Resolvable) -CONSIDERATIONS.md documents why fzf was shelved: it indexed 194k files without respecting `bloat_exclusions.lst`. The fix is already documented: +CONSIDERATIONS.md documents why fzf was shelved: it indexed 194k files without respecting `bloat_exclusions.lst`. Resolve the exclusions file from the **stable repository root** (via `archwiz.config.ARCHWIZ_ROOT` or repo root), and **prune during traversal** rather than filtering after a full walk: + ```bash -find ~ -type d | grep -vFf bloat_exclusions.lst | fzf +# Example: prune excluded dirs during find (adjust paths to repo root) +EXCL="$(git rev-parse --show-toplevel)/bloat_exclusions.lst" +find "$(git rev-parse --show-toplevel)" -type d \( + $(while read -r d; do [ -n "$d" ] && printf -- '-path */%s -o ' "$d"; done < "$EXCL") -false \) -prune -o -type d -print | fzf ``` -The keyboard issue was Termux-specific and does not apply on Replit. This is ready to implement. + +The keyboard issue was Termux-specific and does not apply on Replit. This is ready to implement once pruning is in place. ### C. Real-Time Chat Feedback (ROADMAP Priority 🔴) -The listener executes code blocks but cannot send results back to the conversation. The methodology log proves `stream_completion()` is the correct path (Attempt C). The missing piece is a `report_back(session_id, text)` helper that calls `stream_completion` with the execution result as a user message. +Do **not** add `report_back` onto legacy `activity_listener.py`. Route execution results through the **canonical** cache-write → `dispatch_pipeline.py` path using a non-dispatching message/event append with an **idempotency guard** so each result is recorded once. Avoid calling `stream_completion()` from a path that re-enters dispatch and risks recursive or duplicate reports. ### D. ChronoMancer Branch-Routing UI (ROADMAP 🟡) `cli-synthegration/Chronos/accelerator.py` and `versioner.py` have the data layer. What's missing is a TUI visualizer for the branch tree — a read-only `curses` (or rich-text) panel showing fork points and child session previews. @@ -198,7 +212,7 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default - `SECURITY.md` and harvester READMEs — explicit opt-in model for credential tooling - `requirements-base.txt` + `setup.sh` — fills the missing dependency declaration gap -**Critical gaps (fixes applied on `master`):** +**Critical gaps (fixes applied on this branch / tracked):** | Gap | Severity | Fix applied | |-----|----------|-------------| @@ -209,7 +223,7 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default | Module-level constants missing — callers need `from archwiz.config import ARCHWIZ_DIR` | 🟡 Medium | Added flat module-level constants as drop-in replacements | | `multi-ai-cli/core/core.py` dispatch hook copies the silent `except: pass` bug | 🔴 High | Not yet fixed — tracked in task #3 | -**Verdict:** Merging is conditional on completing task #3 (silent dispatch failure). The config design is sound. The bridge hardening and security documentation are genuine improvements. +**Verdict:** Do not merge until task `#3` (silent dispatch failure) is fixed and verified. The config design is sound. The bridge hardening and security documentation are genuine improvements. --- @@ -229,7 +243,7 @@ Sessions created without the `thinking_enabled`/`search_enabled` fields default | `multi-ai-cli/core/core.py` uses hardcoded `~/.mistralai-cli/` paths — ignores `archwiz/config.py` for its own storage | 🟡 Medium | Replace with `from archwiz.config import SESSION_STORE` or a parallel `MISTRALAI_SESSION_STORE` constant in config.py | | Dispatch hook (`core.py:64-65`) is `except Exception: pass` — copies the deepcli silent-failure bug | 🔴 High | Log to stderr; tracked in task #3 | | `multi-ai-cli/requirements.txt` is independent — not reconciled with `requirements-base.txt` | 🟡 Medium | Merge or reference from root baseline | -| `WASM_SOLVER` path constructed relative to `__file__` — solver target may be missing or resolve to incorrect package-relative location | 🟡 Medium | Resolve via `archwiz.config.DEEPCLI_DIR` or a package-local `__file__`-relative path with an existence check | +| `WASM_SOLVER` may be missing or resolve to an incorrect package-relative location (not a cwd-change failure) | 🟡 Medium | Resolve via `archwiz.config.DEEPCLI_DIR` or package-local path with an existence check | | No equivalent of `archwiz/sentinel.py` or `archwiz/probe.py` for Mistral output — verification absent | 🟢 Low | Future: extend Sentinel to validate multi-ai-cli executions | **What to expand:** diff --git a/skills-lock.json b/skills-lock.json index 21e1db9f09..f26dcebc10 100644 --- a/skills-lock.json +++ b/skills-lock.json @@ -5,7 +5,7 @@ "source": "vercel-labs/skills", "sourceType": "github", "skillPath": "skills/find-skills/SKILL.md", - "computedHash": "b146008599c31057cef1c145774cea5d5afb30e8f43fa802e47a4b461419aaaf" + "computedHash": "c00eeea0e13e74fe4a9d84ba0a8542205a1b736d65f13134fe1a6647eb14976f" } } }